CVE-2023-44487 — Laboratório de Teste de Reset Rápido HTTP/2
Ambiente educacional para o Trabalho de Casa 4 da LTAT.04.022.
Quatro contêineres permitem escanear e comparar configurações vulneráveis vs. corrigidas.
Mapa de Portas
| Contêiner | Porta | Software | Status |
|---|
| nginx-vuln | 8441 | nginx 1.24 | Vulnerável |
| nginx-secure | 8442 | nginx latest | Corrigido |
| apache-vuln | 8443 | Apache 2.4.57 | Vulnerável |
| apache-secure | 8444 | Apache latest | Corrigido |
1. Configuração
# Generate self-signed TLS certs (required by all containers)
bash gen-certs.sh
# Start all 4 containers
docker compose up -d
# Verify all are running
docker compose ps
2. Teste Básico de Conectividade
# Check each container responds (ignore cert warning with -k)
curl -k --http2 -I https://localhost:8441 # nginx vulnerable
curl -k --http2 -I https://localhost:8442 # nginx secure
curl -k --http2 -I https://localhost:8443 # apache vulnerable
curl -k --http2 -I https://localhost:8444 # apache secure
Esperado: HTTP/2 200 de todos os quatro.
3. Confirme que HTTP/2 está Ativo
curl -k --http2 -v https://localhost:8441 2>&1 | grep -E "ALPN|HTTP/"
Procure por:
* ALPN: server accepted h2
< HTTP/2 200
4. Execute o Scanner de CVE
# Copy the scanner here first (or adjust the path)
cp ../scanner.py .
python3 scanner.py localhost 8441 # nginx vuln
python3 scanner.py localhost 8442 # nginx secure
python3 scanner.py localhost 8443 # apache vuln
python3 scanner.py localhost 8444 # apache secure
Resultados esperados:
5. Verifique os Limites de Stream (Diferença Chave)
Use nghttp para inspecionar o quadro SETTINGS que cada servidor envia.
Isso mostra o valor SETTINGS_MAX_CONCURRENT_STREAMS diretamente.
# Install nghttp2 client
sudo apt install nghttp2-client # Ubuntu/Debian
brew install nghttp2 # macOS
# Inspect SETTINGS frame
for port in 8441 8442 8443 8444; LIKELY PAdo
streams=$(nghttp -nvy https://localhost:$port 2>&1 | grep "MAX_CONCURRENT" | tail -1 | awk -F: '{print $2}' | tr -d ']')
echo "port $port → MAX_CONCURRENT_STREAMS: $streams"
done
# (Results)
port 8441 → MAX_CONCURRENT_STREAMS: 128
port 8442 → MAX_CONCURRENT_STREAMS: 32
port 8443 → MAX_CONCURRENT_STREAMS: 1000
port 8444 → MAX_CONCURRENT_STREAMS: 32
Servidor vulnerável: limite alto de stream (128+)
Servidor seguro: limitado a 32
6. Simule a Pressão de Reset Rápido (Seguro, Apenas Local)
Isso envia 50 requisições rapidamente em uma conexão — não é um ataque real,
mas mostra o comportamento de tratamento de RST do servidor nos logs.
# h2load is part of nghttp2-client
h2load -n 1000 -c 1 -m 50 https://localhost:8441 # vuln
h2load -n 1000 -c 1 -m 50 https://localhost:8442 # secure
Logs esperados para exemplos:
$ h2load -n 1000 -c 1 -m 1000 https://localhost:8441
starting benchmark...
spawning thread #0: 1 total client(s). 1000 total requests
TLS Protocol: TLSv1.3
Cipher: TLS_AES_256_GCM_SHA384
Server Temp Key: X25519 253 bits
Application protocol: h2
progress: 10% done
progress: 20% done
progress: 30% done
progress: 40% done
progress: 50% done
progress: 60% done
progress: 70% done
progress: 80% done
progress: 90% done
progress: 100% done
finished in 22.51ms, 44428.65 req/s, 5.38MB/s
requests: 1000 total, 1000 started, 1000 done, 1000 succeeded, 0 failed, 0 errored, 0 timeout
status codes: 1000 2xx, 0 3xx, 0 4xx, 0 5xx
traffic: 124.07KB (127049) total, 83.01KB (85000) headers (space savings 38.85%), 23.44KB (24000) data
min max mean sd +/- sd
time for request: 260us 2.98ms 2.25ms 384us 87.70%
time for connect: 2.51ms 2.51ms 2.51ms 0us 100.00%
time to 1st byte: 3.24ms 3.24ms 3.24ms 0us 100.00%
req/s : 45059.11 45059.11 45059.11 0.00 100.00%
$ h2load -n 1000 -c 1 -m 1000 https://localhost:8442
starting benchmark...
spawning thread #0: 1 total client(s). 1000 total requests
TLS Protocol: TLSv1.3
Cipher: TLS_AES_256_GCM_SHA384
Server Temp Key: X25519 253 bits
Application protocol: h2
progress: 10% done
finished in 5.38ms, 18583.91 req/s, 2.33MB/s
requests: 1000 total, 1000 started, 167 done, 100 succeeded, 900 failed, 900 errored, 0 timeout
status codes: 100 2xx, 0 3xx, 0 4xx, 0 5xx
traffic: 12.83KB (13134) total, 8.30KB (8500) headers (space savings 38.85%), 2.25KB (2300) data
min max mean sd +/- sd
time for request: 83us 1.04ms 533us 256us 63.00%
time for connect: 2.96ms 2.96ms 2.96ms 0us 100.00%
time to 1st byte: 3.55ms 3.55ms 3.55ms 0us 100.00%
req/s : 19316.22 19316.22 19316.22 0.00 100.00%
O contêiner seguro mostrará resets ou recusas de conexão quando o limite de stream for atingido; o vulnerável aceitará todos os 50 sem reclamação.
7. Compare Cabeçalhos do Servidor
# Vulnerable servers expose version info
curl -k -I https://localhost:8441 2>/dev/null | grep -i server
curl -k -I https://localhost:8443 2>/dev/null | grep -i server
# Secure servers hide or minimize version info
curl -k -I https://localhost:8442 2>/dev/null | grep -i server
curl -k -I https://localhost:8444 2>/dev/null | grep -i server
8. Desmontagem
O que as Configurações Mudam (Resumo)
nginx
Apache
| Configuração | Vulnerável (2.4.57) | Seguro (2.4.58+) |
|---|
H2MaxSessionStreams | 1000 | 32 |
ServerTokens |
Referências
hirokiii/cve-2023-44487
